CVE-2026-113616 in LogixFast Auth Plugin
Summary
by MITRE • 10/29/2026
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's password, including an administrator's, and take over the account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The LogixFast Auth WordPress plugin prior to version 1.0.4 contains a critical authentication bypass vulnerability stemming from improper validation of email addresses during the password recovery process. This flaw allows unauthenticated attackers to manipulate the destination for one-time reset codes, effectively neutralizing the security mechanism designed to verify user identity through possession of an associated email account. The core technical issue lies in the plugin's failure to resolve the requested username or email against existing registered users and subsequently validate that the provided recovery address matches the official contact information on file. Instead of sending the verification code exclusively to the pre-registered email address, the application blindly trusts the input field supplied by the attacker during the password reset request. This behavior represents a classic case of insecure direct object references combined with insufficient validation of user-supplied data in authentication workflows.
From an operational perspective, this vulnerability enables complete account takeover for any user on the WordPress installation, including those with administrative privileges. An attacker can initiate a password reset for a specific administrator by providing their own email address as the recovery destination. Upon receiving the one-time code via their personal inbox, the attacker uses it to set a new password, thereby gaining full control over the compromised account. This level of access allows the adversary to modify site settings, install malicious plugins or themes, exfiltrate sensitive data stored within the database, and potentially use the server as a pivot point for further network intrusions. The impact is severe because WordPress administrators typically possess unrestricted access to all content and configuration options, making this vulnerability a high-severity threat to website integrity and confidentiality.
This flaw aligns with CWE-284, which describes Improper Access Control, specifically regarding the failure to enforce proper restrictions on external inputs during authentication processes. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as it facilitates unauthorized access by exploiting weaknesses in credential management and verification procedures. The vulnerability is particularly dangerous because it does not require any prior authentication or privilege escalation; it can be exploited remotely over the web interface with minimal effort. Attackers only need to know a valid username or email address associated with an account on the target site, which are often publicly available through user profile pages or comment sections in WordPress environments.
Mitigation strategies must prioritize immediate remediation by updating the LogixFast Auth plugin to version 1.0.4 or later, where this logic error has been corrected to ensure reset codes are sent only to verified email addresses associated with the account. In cases where an update is not immediately feasible, administrators should implement compensating controls such as rate limiting on password reset requests to prevent automated enumeration and brute-force attacks. Additionally, enabling multi-factor authentication adds a critical layer of defense that can mitigate the impact even if a password is compromised through this vector. Regular security audits and code reviews focusing on input validation in authentication modules are essential to preventing similar vulnerabilities in custom or third-party WordPress extensions.